Most people find out something is wrong with their website when a customer tells them. The browser says "Not secure", a form stopped sending, the site crawls on mobile, a link in last year's newsletter goes nowhere.
Nearly all of that is findable in advance, by you, without an account and without paying anybody. We build free tools for this because the alternative is a business guessing, or paying for an audit to be told something a thirty second check would have shown.
Here is the order we would run them in, what a bad answer actually means, and what to do about it. Ten minutes, start to finish.
- Start With the One That Scores Everything
- Why Your Site Says Not Secure
- Whether It Is Fast Enough on a Phone
- Whether Google and ChatGPT Can Read It
- What You Look Like in Search Results
- What Is Broken and Where Links Go
- The Protections Browsers Expect
- Who Is Actually Hosting You
- Whether Anybody Is Visiting
- The Order Worth Fixing Them In
Start With the One That Scores Everything
If you only do one thing, do this one. Our website checkup scores your site on SEO, mobile, AI search, trust and speed, and gives the fixes in plain English rather than developer shorthand. It is the fastest way to find out whether you have a small problem or a long list.
Everything below drills into one area in more detail. Run the checkup first so you know which of them is worth your attention.
Why Your Site Says Not Secure
The "Not secure" warning costs you more than anything else on this page, because it appears before anybody reads a word. It usually has one of three causes, and our free SSL checker tells you which: an expired certificate, a missing redirect from http to https, or mixed content, which means a secure page loading an image or script over an insecure connection.
The checker also tells you when your certificate expires. That date matters more than people expect, because certificates lapse quietly and the first warning is usually a customer screenshot.
If the answer is an expiry date in the next month, deal with it this week. If the answer is mixed content, it is usually a handful of old image links and a short job for whoever maintains the site.
Whether It Is Fast Enough on a Phone
Our PageSpeed test checks how fast your site loads on mobile and desktop and gives a verdict in seconds. Mobile is the number that matters in Kenya, because that is how most people will arrive and they will be on mobile data rather than office fibre.
If you want to understand the three numbers behind the score rather than just the score, we have written them up in Core Web Vitals for Kenyan websites.
Whether Google and ChatGPT Can Read It
There is a file on your site called robots.txt that tells crawlers what they may look at. Get it wrong and you can block Google from your own website, which happens more often than you would think, usually left over from when the site was being built.
Our robots.txt checker shows which search engines and AI crawlers can reach your site, the exact line responsible for each answer, and what to fix first. The AI part is newer and worth a look: if you have an opinion about whether ChatGPT and other assistants should be able to read your pages, this is where that opinion is actually expressed. We have written more on that in robots.txt and AI crawlers.
What You Look Like in Search Results
Your page title and description are what people read in Google before deciding whether to click. They are also the thing most likely to be missing, duplicated across every page, or cut off halfway through a sentence.
Our meta tag checker checks titles and descriptions on every page and previews how each looks in Google and when shared on Facebook or WhatsApp. That second part catches a common and embarrassing problem: a link shared to a WhatsApp group showing no image, no description, or the wrong page's text entirely.
What Is Broken and Where Links Go
Two tools, closely related.
The broken link checker finds every broken link, redirect and insecure link on your site, with a note on why each one matters. Broken links accumulate silently: a supplier changes their website, you delete a page, a product goes away.
The redirect checker follows every redirect between an address and the page that finally loads, flagging loops and temporary redirects. This is the one to reach for when a page loads slowly for no obvious reason, or when an old address stopped working after a redesign. A chain of four redirects is both slow and fragile.
The Protections Browsers Expect
Security headers are instructions your site sends the browser about how to protect the person reading it. They are invisible, they cost nothing, and most Kenyan sites we test are missing several.
Our security headers checker grades your site from A to F and gives the exact line to add for each missing one. If you run WordPress on Apache, our .htaccess generator will build the configuration for you: tick what you need for https, www, redirects, gzip, caching and WordPress hardening, and it writes the file. It runs in your browser, so nothing is uploaded anywhere.
Who Is Actually Hosting You
This sounds like a question you should already know the answer to. A surprising number of businesses do not, because a developer arranged it years ago.
Our hosting checker works out the web host from your DNS, names the network owner, and tells you when something like Cloudflare is in front and hiding the real answer. Worth running on your own site if anybody has ever said "the guy who built it handles all that", and worth running on a competitor's if you are curious why theirs is faster. We have written about the control side of this in who actually owns your .ke domain.
Whether Anybody Is Visiting
Our free website audit gives a snapshot of your traffic, your top pages and your search performance, with no signup. It answers the question underneath all the others, which is whether any of this is reaching people yet.
It is also the check that reframes the rest. A site with no traffic has a visibility problem, and making it marginally faster will not fix that. A site with traffic and no enquiries has a different problem again, and that one is usually about what the pages say rather than how they perform.
- JSON formatter and validator, which explains the line and column of any mistake in plain English.
- URL encoder and decoder, which also reads a long tracking link as a table of its parts. Useful for working out what a campaign link is actually carrying.
- Base64 encoder and decoder, with URL safe output and full support for accents and emoji.
The Order Worth Fixing Them In
Ten results can be paralysing. This is the order we would work in, and it is not the order of technical severity. It is the order of what costs you customers.
| Priority | Fix | Why first |
|---|---|---|
| 1 | Anything making the browser say "Not secure" | It turns people away before they read anything |
| 2 | A robots.txt line blocking search engines | One line can keep you out of Google entirely |
| 3 | Broken links on pages people actually reach | A dead link on a contact or product page costs a real enquiry |
| 4 | Mobile speed, if the verdict was poor | Most Kenyan visitors arrive on a phone on mobile data |
| 5 | Titles and descriptions | Cheap to fix and changes how many people click |
| 6 | Security headers | Real, free, and nobody notices until something goes wrong |
| 7 | Redirect chains | Worth tidying once the above are done |
Work down that list and you will have dealt with most of what actually loses a Kenyan business money online. None of it needs us.
What the tools will not tell you is whether your site says the right things to the right people, or whether the thing it was built for still matches what the business does now. That is the part worth a conversation, and it is where a maintained site differs from a checked one: somebody notices the drift.
Frequently Asked Questions
How can I check my website for free?
Start with our website checkup at wpfoss.ke/website-checkup, which scores your site on SEO, mobile, AI search, trust and speed and gives the fixes in plain English. From there, specific tools answer specific questions: the SSL checker for why a browser says "Not secure", the PageSpeed test for mobile speed, the robots.txt checker for whether search engines and AI crawlers can reach you, the meta checker for how you appear in Google and WhatsApp, the broken link and redirect checkers for what is broken, the security headers checker for protections you are missing, the hosting checker for who hosts you, and the free website audit for whether anyone is visiting. None needs an account.
Why does my website say Not secure?
Almost always one of three things: your SSL certificate has expired, there is no redirect sending visitors from http to https, or you have mixed content, which means a secure page loading an image or script over an insecure connection. Our free SSL checker at wpfoss.ke/ssl-checker tells you which of the three it is and when your certificate expires. Deal with this before anything else on your site, because the warning appears before a visitor reads a single word.
What should I fix first on my website?
Not what is technically worst, but what costs you customers. In order: anything making the browser say "Not secure", then any robots.txt line blocking search engines, then broken links on pages people actually reach like contact and product pages, then mobile speed if the verdict was poor, then page titles and descriptions, then security headers, then redirect chains. That sequence deals with most of what genuinely loses a Kenyan business money online, and none of it needs a developer to diagnose.
Can one line really keep my site out of Google?
Yes. The robots.txt file tells crawlers what they may look at, and a rule left over from when the site was being built can block search engines from the whole site. It is one of the more common serious faults we find, precisely because nothing visibly breaks: the site looks perfectly normal to you while being invisible in search. Our robots.txt checker shows which crawlers can reach you and the exact line responsible for each answer.
How do I find out who is hosting my website?
Our free hosting checker at wpfoss.ke/who-is-hosting-this-website works out the web host from your DNS, names the network owner, and tells you when a service like Cloudflare is sitting in front and hiding the real host. It is worth running on your own site if anyone has ever said that the person who built it handles all of that, because knowing who hosts you is the first step to being able to move or fix anything.
Do these free tools send my data anywhere or need an account?
No account, no signup. The .htaccess generator runs entirely in your browser, so nothing you tick is uploaded at all. The checkers need your website address because they have to look at the public version of your site, which is the same thing any visitor or search engine sees. We built them this way deliberately: a business should be able to find out what is wrong with its own website without filling in a form and waiting for a sales call.
Start with the checkup, it takes about a minute
One address, one score, plain English fixes, no account. If the list that comes back is longer than you want to deal with yourself, talk to us on WhatsApp at +254 722 334 188 or email hello@wpfoss.ke and we will tell you what actually matters and what it would take to fix.
Run the Free Website CheckupAll fourteen tools: wpfoss.ke/tools